Diplomarbeit-Absolventenverein/oqtane.framework
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update TabStrip.razor

Browse Source 
The authorization flow is:
•	Host tabs: Only Host (Admin blocked by Step 1)
•	Everything else: Admin bypasses, others check permissions
This commit is contained in:
Leigh Pointer
2025-12-13 21:56:05 +01:00
parent 01ad99b925
commit e62268af2e
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
Oqtane.Client/Modules/Controls/TabStrip.razor
View File

@@ -96,16 +96,22 @@
/// <returns>True if user is authorized to see this tab, false otherwise</returns>
private bool IsAuthorized(TabPanel tabPanel)
{
// Step 1: Host and Admin bypass all restrictions
if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host) ||
UserSecurity.IsAuthorized(PageState.User, RoleNames.Admin))
// Step 1: Check for Host-only restriction
if (tabPanel.Security == SecurityAccessLevel.Host)
{
// Only Host users can access Host-level security tabs (Admin users are excluded)
return UserSecurity.IsAuthorized(PageState.User, RoleNames.Host);
}
// Step 2: Admin bypass all other restrictions
if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Admin))
{
return true;
}
var authorized = false;
// Step 2: Check standard SecurityAccessLevel
// Step 3: Check standard SecurityAccessLevel
switch (tabPanel.Security)
{
case null:
@@ -120,15 +126,18 @@
case SecurityAccessLevel.Edit:
authorized = UserSecurity.IsAuthorized(PageState.User, PermissionNames.Edit, ModuleState.PermissionList);
break;
case SecurityAccessLevel.Host:
authorized = UserSecurity.IsAuthorized(PageState.User, RoleNames.Host);
break;
}
// Step 3: Check RoleName if provided (additional requirement)
// Step 4: Check RoleName if provided (additional requirement)
if (authorized && !string.IsNullOrEmpty(tabPanel.RoleName))
{
authorized = UserSecurity.IsAuthorized(PageState.User, tabPanel.RoleName);
}
// Step 4: Check PermissionName if provided (additional requirement)
// Step 5: Check PermissionName if provided (additional requirement)
if (authorized && !string.IsNullOrEmpty(tabPanel.PermissionName))
{
authorized = UserSecurity.IsAuthorized(PageState.User, tabPanel.PermissionName, ModuleState.PermissionList);